Data retention

Toado retains data conservatively. Active data lives indefinitely; archived data is preserved for a long retention window; deleted data is purged on a schedule.

Per-resource retention

Resource	Active	Archived	Deleted	Notes
Tickets	Indefinite	365 days	30 day soft-delete window, then permanent	Archive is reversible. Delete is not: the ticket is hidden from every surface at once, then purged for good 30 days later.
Comments	Indefinite	Same as parent ticket	Same as parent ticket	Comments live and die with their ticket.
Captures (screenshot, DevTools data)	Indefinite	Same as parent ticket	Same as parent ticket	Stored in object storage; deletion is asynchronous, may take 24 hours after the trigger.
Annotations	Indefinite	Same as parent ticket	Same as parent ticket
Attachments	Indefinite	Same as parent ticket	Same as parent ticket
API tokens	Until revoked	n/a	Immediately on revoke	Revocation is effective immediately for new requests; in-flight requests may complete.
Audit logs	365 days, then aged out automatically	n/a	90 days after account closure	The retention worker deletes entries older than a year.
Pending invitations	Until accepted, revoked, or 14 days	n/a	Immediately on revoke or expiry
Web app sessions	30 days idle	n/a	Immediate on sign-out
Extension offline queue	Locally on your machine	n/a	When you discard or `Reset extension`	The queue is on the user’s device, not on our servers.
Widget reporter name, email, and custom answers	Same as the ticket	Same as parent ticket	Same as parent ticket	Collected only when configured or supplied.
Widget reporter IP	30 days	30 days	Cleared automatically	Used for abuse prevention and never returned by the ticket API.
Widget detection history and origins	While the project widget exists	n/a	With widget/project deletion	Used for installation status and allowed-site setup.
Widget settings and key-rotation audit events	Same as audit logs	n/a	90 days after account closure	The old key is invalid immediately after rotation.

Delete

Delete is destructive and there is no undo in the product. Deleting a ticket or a draft takes it off every surface at once, along with its capture, annotations and attachments, and nothing in the app brings it back. Use Archive for anything you may want again: archive is the reversible one.

Underneath, a delete is a soft-delete first: the row is marked deleted and hidden from every query, then the retention worker purges the row and its stored files for good 30 days later. Contact support promptly with recovery questions; recovery after deletion is not guaranteed.

The same purge happens without anyone pressing Delete when:

An account is closed (the account owner triggers it from Settings › Account › Close account).
A company is deleted by its owner (also from settings).
A ticket is removed from a page with the extension, which archives it and deletes it ten days later unless it is restored first.
The data retention worker purges archived data after the retention window.

Account closure

When an account is closed:

Sign-in is disabled immediately for that user.
The user is removed from all companies they were a member of.
Tickets they created remain in those companies (with the user’s name preserved as the creator).
Comments they posted remain (with their name as the author).
Personal API tokens are revoked.
Any companies where they were the sole owner are queued for deletion (with email warning).
Personal data (email, name, profile picture) is purged after the 30-day soft-delete window.

Company deletion

When a company is deleted by its owner:

All projects, tickets, comments, captures, annotations, and attachments are queued for deletion.
All members lose access immediately.
After the 30-day soft-delete window, all data is permanently purged.

A company with active billing must cancel billing before deletion. See your billing settings.

Object storage

Captured screenshots and attachments live in object storage (S3-compatible). Deletion requests propagate asynchronously. A deleted ticket’s screenshot may remain in object storage for up to 24 hours after the relational delete. The bytes are unreachable via any Toado API during this window.

Widget screenshots and capture assets follow the same lifecycle as other ticket captures.

Widget processing is covered by the live Privacy Policy and DPA. Those live pages are canonical if this operational summary ever differs from the legal policy.

Walkthrough media

Audio is not automatically redacted. To remove retained recording audio, permanently delete every ticket that references that recording. Archiving or removing a ticket from the active board does not by itself remove all recording references. Deletion and storage cleanup follow their normal lifecycle; this does not promise immediate physical erasure.

Walkthrough video and audio have plan-configured retention and can expire before the ticket or transcript. Check the current allowance and expiry message in the app; retention values can be configured per plan. An expired clip is not evidence that its ticket was deleted.

Recording masters are processing inputs for the ticket clips and are cleaned up separately. Local recovery data and server media also have separate cleanup paths. Do not rely on a browser copy or a raw master as a permanent backup. See Walkthrough recording for upload, processing, and review.

Exporting a clip or annotated image to Jira creates a copy governed by the Atlassian site’s own retention. Unlinking a Toado ticket or disconnecting Jira does not remove that copy.

Backups

We take encrypted backups of the relational database daily, retained 30 days. Object storage has its own provider-side replication and lifecycle.

Backups are operational (used for disaster recovery), not user-facing. We do not restore individual tickets from backup.

Where to next

Security for the broader trust model.
Archive & restore for the archive workflow.
Contact for data retention or DPA questions.